Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752648AbaAWKYE (ORCPT ); Thu, 23 Jan 2014 05:24:04 -0500 Received: from cantor2.suse.de ([195.135.220.15]:51646 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751648AbaAWKYA (ORCPT ); Thu, 23 Jan 2014 05:24:00 -0500 Date: Thu, 23 Jan 2014 11:23:53 +0100 (CET) From: Jiri Kosina To: Linus Torvalds , Jan Kara cc: Dave Jones , Linux Kernel Subject: Re: fanotify use after free. In-Reply-To: Message-ID: References: <20140122062730.GA25601@redhat.com> <20140122233622.GB27916@quack.suse.cz> User-Agent: Alpine 2.00 (LNX 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 22 Jan 2014, Linus Torvalds wrote: > > But refcounting seems like an overkill for this - there is exactly one > > fanotify_response_event structure iff it is a permission event. So > > something like the (completely untested) attached patch should fix the > > problem. But I agree it's a bit ugly so we might want something different. > > I'll try to think about something better tomorrow. > > Ok, In the meantime, Dave, can you verify whether this hacky patch > fixes your problem? I reported the same slab corruption yesterday as well here: https://lkml.org/lkml/2014/1/22/173 With the patch applied, I am still seeing the slab corruption, preceeded by GPF (which is not there without the patch) in lockref_put_or_lock(&dentry->d_lockref) in dput(): general protection fault: 0000 [#1] SMP Modules linked in: tpm_tis(+) tpm wmi acpi_cpufreq autofs4 uhci_hcd ehci_hcd i915 drm_kms_helper drm i2c_algo_bit button usbcore video usb_common edd fan processor ata_generic thermal thermal_sys CPU: 1 PID: 275 Comm: systemd-readahe Not tainted 3.13.0-03478-g670d0ac #1 Hardware name: LENOVO 7470BN2/7470BN2, BIOS 6DET38WW (2.02 ) 12/19/2008 task: ffff880037c09150 ti: ffff88007359e000 task.ti: ffff88007359e000 RIP: 0010:[] [] do_raw_spin_lock+0x17/0x160 RSP: 0018:ffff88007359fc78 EFLAGS: 00010286 RAX: ffff880037c09150 RBX: 6b6b6b6b6b6b6beb RCX: 0000000000000000 tpm_tis 00:09: 1.2 TPM (device-id 0x1020, rev-id 6) tpm_tis 00:09: Intel iTPM workaround enabled RDX: 0000000000000000 RSI: 0000000000000000 RDI: 6b6b6b6b6b6b6beb RBP: ffff88007359fc98 R08: 0000000000000002 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 6b6b6b6b6b6b6beb R13: ffff880037310690 R14: 0000000000000020 R15: ffff880036dbfc10 FS: 00007fa953e4a700(0000) GS:ffff88007c280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff76a10258 CR3: 000000003659c000 CR4: 00000000000007e0 Stack: 6b6b6b6b6b6b6beb 6b6b6b6b6b6b6beb 6b6b6b6b6b6b6beb ffff880037310690 ffff88007359fcb8 ffffffff8159c59c ffffffff812fe101 6b6b6b6b6b6b6beb ffff88007359fcd8 ffffffff812fe101 ffff88007359fd08 6b6b6b6b6b6b6b6b Call Trace: [] _raw_spin_lock+0x3c/0x50 [] ? lockref_put_or_lock+0x11/0x40 [] lockref_put_or_lock+0x11/0x40 [] dput+0x22/0x130 [] path_put+0x15/0x30 [] fanotify_free_event+0x15/0x40 [] fsnotify_destroy_event+0x1c/0x30 [] fanotify_handle_event+0x341/0x390 [] send_to_group+0xfb/0x180 [] ? fsnotify+0x80/0x2d0 [] ? do_filp_open+0x45/0xa0 [] fsnotify+0x1c4/0x2d0 [] do_sys_open+0x1ad/0x220 [] ? trace_hardirqs_on_thunk+0x3a/0x3f [] SyS_open+0x19/0x20 [] system_call_fastpath+0x16/0x1b Code: 0d 7e 81 48 89 df e8 29 ff ff ff eb 94 0f 1f 80 00 00 00 00 55 48 89 e5 48 83 ec 20 48 89 5d e8 4c 89 65 f0 48 89 fb 4c 89 6d f8 <81> 7f 04 ad 4e ad de 74 0c 48 c7 c6 b5 0d 7e 81 e8 f4 fe ff ff RIP [] do_raw_spin_lock+0x17/0x160 RSP ---[ end trace 7a918209ee213d28 ]--- BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:20 in_atomic(): 1, irqs_disabled(): 0, pid: 275, name: systemd-readahe INFO: lockdep is turned off. CPU: 1 PID: 275 Comm: systemd-readahe Tainted: G D 3.13.0-03478-g670d0ac #1 Hardware name: LENOVO 7470BN2/7470BN2, BIOS 6DET38WW (2.02 ) 12/19/2008 ffff880037c09150 ffff88007359fa78 ffffffff8159702b ffff88007359fa98 ffffffff8107f621 ffffffff81a3d000 ffff880037b98d90 ffff88007359fab8 ffffffff8159b4ff ffff880037c09150 ffff880037c09150 ffff88007359fae8 Call Trace: [] dump_stack+0x72/0x87 [] __might_sleep+0xe1/0x100 [] down_read+0x1f/0x60 [] exit_signals+0x1f/0x140 [] ? blocking_notifier_call_chain+0x11/0x20 [] do_exit+0xb4/0x4b0 [] oops_end+0xdc/0xe0 [] die+0x56/0x90 [] do_general_protection+0x162/0x170 [] ? restore_args+0x30/0x30 [] general_protection+0x22/0x30 [] ? do_raw_spin_lock+0x17/0x160 [] _raw_spin_lock+0x3c/0x50 [] ? lockref_put_or_lock+0x11/0x40 [] lockref_put_or_lock+0x11/0x40 [] dput+0x22/0x130 [] path_put+0x15/0x30 [] fanotify_free_event+0x15/0x40 [] fsnotify_destroy_event+0x1c/0x30 [] fanotify_handle_event+0x341/0x390 [] send_to_group+0xfb/0x180 [] ? fsnotify+0x80/0x2d0 [] ? do_filp_open+0x45/0xa0 [] fsnotify+0x1c4/0x2d0 [] do_sys_open+0x1ad/0x220 [] ? trace_hardirqs_on_thunk+0x3a/0x3f [] SyS_open+0x19/0x20 [] system_call_fastpath+0x16/0x1b note: systemd-readahe[275] exited with preempt_count 1 BUG: scheduling while atomic: systemd-readahe/275/0x00000002 INFO: lockdep is turned off. Modules linked in: tpm_tis(+) tpm wmi acpi_cpufreq autofs4 uhci_hcd ehci_hcd i915 drm_kms_helper drm i2c_algo_bit button usbcore video usb_common edd fan processor ata_generic thermal thermal_sys CPU: 1 PID: 275 Comm: systemd-readahe Tainted: G D 3.13.0-03478-g670d0ac #1 Hardware name: LENOVO 7470BN2/7470BN2, BIOS 6DET38WW (2.02 ) 12/19/2008 ffff88007c293a00 ffff88007359f6f8 ffffffff8159702b ffff88007359f718 ffffffff810810f1 ffff88007c293a00 0000000000000001 ffff88007359f848 ffffffff8159789c ffff88007359f758 ffff88007359f768 ffff88007359e010 Call Trace: [] dump_stack+0x72/0x87 [] __schedule_bug+0x61/0x80 [] __schedule+0xbc/0x7c0 [] ? mod_timer+0x14c/0x1f0 [] schedule+0x24/0x70 [] schedule_timeout+0x1c5/0x210 [] ? wait_for_completion+0xcf/0x120 [] ? trace_hardirqs_on+0xd/0x10 [] wait_for_completion+0xd7/0x120 [] ? try_to_wake_up+0x250/0x250 [] ? srcu_reschedule+0x4f/0xf0 [] __synchronize_srcu+0xec/0x130 [] ? srcu_barrier+0x10/0x10 [] synchronize_srcu+0x18/0x20 [] fsnotify_destroy_group+0x1d/0x40 [] inotify_release+0x21/0x50 [] __fput+0xbd/0x2b0 [] ____fput+0x9/0x10 [] task_work_run+0xb1/0xe0 [] do_exit+0x1e9/0x4b0 [] oops_end+0xdc/0xe0 [] die+0x56/0x90 [] do_general_protection+0x162/0x170 [] ? restore_args+0x30/0x30 [] general_protection+0x22/0x30 [] ? do_raw_spin_lock+0x17/0x160 [] _raw_spin_lock+0x3c/0x50 [] ? lockref_put_or_lock+0x11/0x40 [] lockref_put_or_lock+0x11/0x40 [] dput+0x22/0x130 [] path_put+0x15/0x30 [] fanotify_free_event+0x15/0x40 [] fsnotify_destroy_event+0x1c/0x30 [] fanotify_handle_event+0x341/0x390 [] send_to_group+0xfb/0x180 [] ? fsnotify+0x80/0x2d0 [] ? do_filp_open+0x45/0xa0 [] fsnotify+0x1c4/0x2d0 [] do_sys_open+0x1ad/0x220 [] ? trace_hardirqs_on_thunk+0x3a/0x3f [] SyS_open+0x19/0x20 [] system_call_fastpath+0x16/0x1b ACPI: AC Adapter [AC] (on-line) Slab corruption (Tainted: G D W ): fanotify_event_info start=ffff880037310690, len=64 Redzone: 0x9f911029d74e35b/0x9f911029d74e35b. Last user: [](fanotify_free_event+0x2d/0x40) 030: 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b a5 kkkkkkkk....kkk. Prev obj: start=ffff880037310638, len=64 Redzone: 0x9f911029d74e35b/0x9f911029d74e35b. Last user: [](fanotify_free_event+0x2d/0x40) 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Next obj: start=ffff8800373106e8, len=64 Redzone: 0x9f911029d74e35b/0x9f911029d74e35b. Last user: [](fanotify_free_event+0x2d/0x40) 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk -- Jiri Kosina SUSE Labs -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/